Cwtch

Every private messenger sells you the same story. End-to-end encryption. We can’t read your messages. Your privacy is our priority. And every one of them — Signal included — is still a service. There’s a company. There are servers. There’s an account tied to something: a phone number, an email, a device identifier. And that means there is a list somewhere of who talks to whom, when, and how often. Encryption protects the contents of the envelope. The envelope itself, with its addresses and postmarks, is still the most valuable intelligence product in the world.

Cwtch — the Welsh word for a hug that makes a safe place, and yes, you pronounce it roughly “kutch” — is what happens when a small Canadian non-profit decides that the envelope is the actual problem.

Built by the Open Privacy Research Society, Cwtch is not an app that connects to Cwtch’s servers, because there are none. There is no Cwtch network, no registration, no account, no username database, no directory. Your identity is a Tor v3 onion address generated on your device. Your contacts are onion addresses. When you message someone, your phone opens an onion service connection directly to theirs. Nothing sits in the middle by default, and nothing needs to know either of you exist.

That design places Cwtch in a specific lineage — the ghost of Ricochet, the same territory Briar occupies — rather than in competition with Signal or WhatsApp. This is not a mainstream messenger with a privacy feature. It is a metadata-resistance research project that grew a usable client, and it wears that origin on its sleeve. It isn’t pretending to chase scale. The people who use it know exactly why they’re there: journalists working with sources, activists in hostile jurisdictions, sex workers, abuse survivors hiding from a determined ex, security researchers who read the protocol spec before installing the binary.

It ships on Android, Windows, macOS, and Linux, distributed through Google Play and as direct APKs and installers from the project’s own release server. There is no iOS build. The developers say platform limitations make it prohibitively difficult — and iOS background execution policy, which throttles persistent networking, makes that credible.

• No server, no account, no identifier: You don’t sign up. The app generates a cryptographic identity locally, and your onion address is your contact card. There is no registry to subpoena, no phone number to correlate, no “recover your account” flow — because there is no account.
• Metadata resistance by consent: Message content is end-to-end encrypted, and the protocol is designed so that even connection metadata isn’t exposed to third parties without you explicitly consenting to reveal it. This is the actual product. Encryption is table stakes; not leaking the social graph is the differentiator.
• Untrusted relay servers for groups: Group chat needs somewhere to hold messages when members are offline. Cwtch’s answer is servers that store encrypted blobs and cannot determine group membership. Run one yourself, borrow a friend’s, lend yours to strangers — the server operator learns nothing worth having.
• Hybrid groups with moderation: Recent releases added member lists and moderation tooling, a pragmatic concession that pure anonymous groups are unmanageable in practice.
• Open protocol, open ecosystem: Third-party bots, services, and alternate clients are all supported by design. Cwtch is closer to a protocol with a reference implementation than to a walled product.
• Cross-platform, non-store distribution: Android, Windows, macOS, Linux, with direct downloads from the project’s own infrastructure — so your ability to run it doesn’t depend on Google’s willingness to list it.

The Threat Model Is the Feature

Judge Cwtch by conventional messenger criteria and it looks mediocre. Judge it by what it’s actually trying to defeat and it has little competition among anything installable from a mainstream app store.

Consider what a subpoena, a hostile ISP, or a compromised backbone gets from Signal versus Cwtch. From Signal: a phone number, account creation date, and last connection date. That’s minimal by industry standards and Signal deserves its reputation. But it’s a non-zero surface, and a phone number is an identity anchor that links to your carrier, your billing address, your legal name. From Cwtch: nothing, because there is no entity holding a record and no phone number ever entered the system. The connection itself is an onion service circuit that reveals neither endpoint to the network.

This is a rare case where an app’s marketing claim is understated by the architecture. Users on Play call it “a technical marvel” with Tor “integrated perfectly,” and that praise is earned. Bundling Tor into a Flutter-based mobile client, managing onion service lifecycles, and keeping the whole thing from collapsing into an unusable mess is serious engineering by a team that could fit around a dinner table.

The Bill Comes Due

Here’s the part the enthusiast reviews soft-pedal. Cwtch is slow, and it drops.

Not slow like a laggy app. Slow like physics. A Tor circuit is at minimum three relays of volunteer-run infrastructure scattered across continents. Round-trip latency measured in seconds is inherent to the design, not a bug. Messages arrive when the circuit cooperates. When Tor is unstable — congested relays, a flaky mobile connection, a network transition from Wi-Fi to LTE — the connection drops and reconnection takes time. Play Store reviewers report exactly this, consistently, and it’s the single most common complaint.

Worse for daily use: both parties generally need to be online for reliable one-to-one delivery. This is the direct, unavoidable consequence of having no server. Modern messaging has trained everyone to expect fire-and-forget — you send at 2 a.m., they read it at 8 a.m., the cloud held it in between. Cwtch has no cloud to hold it in. Peer-to-peer means peers, present tense. The relay-server model patches this for groups, but the asynchronous experience is not what a WhatsApp refugee expects, and the app does not do enough to set that expectation at install time.

Onboarding Is the Weak Link

You add a contact by exchanging a 56-character onion address. Out loud, that’s absurd. Over a text message, it’s a copy-paste that partially defeats the point if the channel you used is the one being watched. And as of the current Android build, there is still no QR code flow — the single most requested feature in the reviews, and the one thing that would convert in-person contact exchange from a chore into three seconds of pointing a camera.

The add-contact screen also has a contrast problem users have flagged directly: text that’s hard to read against its background. For an app whose entire value proposition depends on getting a long random string exactly right, a low-legibility field is not a cosmetic nitpick. It’s a correctness hazard in the most critical interaction in the product.

The gap between Cwtch’s cryptographic sophistication and its interaction design is the central tension here. The hard part — a metadata-resistant transport with untrusted relays — is solved to a standard most commercial teams never reach. The easy part — help two people connect without a spreadsheet — is unfinished. That inversion is common in privacy tooling, and it is precisely why privacy tooling keeps failing the people it was built for. The activist facing real consequences is often the least equipped to debug a Tor circuit.

The Hybrid Group Compromise

The addition of hybrid groups with member lists and moderation is the most interesting product decision in recent releases, because it’s a deliberate step back from maximalism. Fully metadata-blind groups are theoretically beautiful and practically ungovernable — no one knows who’s present, no one can remove a bad actor, and harassment has no remedy. Open Privacy chose to let groups reveal more in exchange for being usable and moderatable. That’s mature thinking from a research organization that could easily have defended the purer design and shipped something nobody could run a community on.

The interface is clean, modern Material-adjacent design — dark by default, uncluttered, legible in most places. It does not look like a hobbyist project, which matters more than aesthetes admit: an app that looks unfinished feels untrustworthy regardless of the cryptography behind it. Cwtch clears that bar. Four screenshots on its Play listing, a competent icon, no visual embarrassment.

But polish is not the same as refinement. Contrast failures in the add-contact flow, no camera-based address exchange, and connection states that don’t always explain themselves in plain language are the difference between a good-looking app and a well-designed one. When a message fails to send, the user needs to know whether their contact is offline, whether the circuit collapsed, or whether they should retry — and they need it in a sentence a stressed person can parse.

Performance splits cleanly in two. The interface is built to keep local interactions — scrolling, typing, navigation — light. Network performance is dictated entirely by Tor, and no amount of client optimization changes that. Expect seconds, not milliseconds. Expect reconnects. Expect a battery cost from maintaining live onion services, because a persistent connection on a mobile radio is the most expensive thing an app can do.

Android is Cwtch’s real home, and it’s also where the architecture fights the operating system hardest.

Every mainstream messenger on Android uses Firebase Cloud Messaging to wake up on an incoming message. That’s how you get instant notifications with negligible battery drain — Google maintains one socket for the whole phone. Cwtch cannot use it. FCM would require a central server that knows a message is destined for your device, which is exactly the metadata Cwtch exists to eliminate. So Cwtch has to hold its own connections open, which means fighting Doze mode, aggressive background-process killing, and OEM battery optimizers that treat any long-lived socket as a bug to be terminated. Chinese and Samsung firmware are notoriously hostile here.

The practical translation: Cwtch likely needs to be manually exempted from battery optimization, and even then, delivery reliability on Android is a function of how much a given phone’s manufacturer hates background apps. This isn’t a flaw Open Privacy can fix. It’s the tax on refusing to route through Google.

Distribution deserves credit. Google Play availability lowers the barrier for people who won’t sideload, while direct APKs from the project’s own release server mean the app survives if Google ever decides it doesn’t like a Tor-based messenger. Both channels matter, and offering both is the right call.

Then there’s the absence: no iOS client. The developers cite platform limitations, and that’s not an excuse — iOS background execution policy makes persistent onion services close to impossible without exactly the push infrastructure Cwtch is designed to avoid. But the consequence is real. In much of the world, the people at highest risk carry iPhones specifically because iOS has the better security reputation. Cwtch cannot reach them, and that’s a strategic wound, not a footnote.

Cwtch is a serious piece of work that most people should not install — and that a small number of people should install, learn thoroughly, and be glad exists.

Open Privacy has built the thing the privacy community has been asking for since Ricochet: a metadata-resistant messenger that ordinary hardware can actually run, distributed through channels that don’t require a corporate gatekeeper’s permission, backed by an organization with no incentive to ever betray it. The architecture is not a compromise dressed up in marketing language. It eliminates attack surface that competitors merely minimize.

What holds it back is not the cryptography. It’s the last hundred meters. A QR code scanner would fix the worst onboarding failure. A contrast pass on one screen would fix the worst usability hazard. Clearer connection-state messaging would convert many “it’s broken” complaints into “it’s syncing.” None of these require compromising the threat model, and all of them stand between Cwtch and the people who need it but will never make it past the add-contact screen.

Judge it as a product and it’s rough around the edges in ways that matter. Judge it as infrastructure — as working proof that you can have real communication without anyone owning the record of it — and it earns its place. We recommend it to the audience above, with patience, and with Signal kept for dinner plans.